Android Malware Adventures: Evasion, Droppers, & Modern Mobile Tradecraft

The Evolution of Android Mobile Malware

Android malware developers have adopted advanced evasion techniques borrowed from desktop malware, allowing malicious applications to slip past Google Play Protect and on-device antivirus scanners.

Multi-Stage Droppers and Dynamic Payload Decryption

Kürşat Akıncı and Mert Can Coşkuner dissect mobile droppers disguised as benign utilities that decrypt and load secondary APK/DEX payloads directly into memory.

Bypassing Dynamic Analysis and Sandbox Emulators

The speakers demonstrate how Android malware detects emulated analysis environments (QEMU, Frida hooks, debugger presence) to conceal malicious behavior during automated sandbox runs.

Mobile Threat Hunting and Defensive Telemetry

The presentation provides mobile security analysts with static analysis workflows, YARA signatures, and behavioral heuristics to detect evasive Android implants.